Senior AWS Security Architect

Role & responsibilities

AWS Security Strategy and Architecture

• Define AWS cloud security strategy, target-state architecture, security principles, patterns, standards, and roadmaps aligned with business and regulatory requirements.
• Design secure, resilient, scalable, and cost-aware architectures using AWS Well-Architected security and operational principles.
• Lead architecture reviews, threat modelling, risk assessments, design assurance, and security exception evaluations for new and existing workloads.
• Create reference architectures and reusable patterns for internet-facing applications, APIs, data platforms, containers, serverless workloads, and hybrid connectivity.
• Provide technical leadership to cloud platform, engineering, DevOps, SOC, application, risk, audit, and compliance teams.

Multi-Account Governance and Landing Zone Security

• Design and secure AWS Organizations and AWS Control Tower environments, including organizational units, account vending, delegated administration, and centralized security services.
• Define and maintain preventive, detective, and proactive guardrails using service control policies, resource control policies where applicable, AWS Config, and policy-as-code approaches.
• Establish centralized logging, security tooling, network inspection, backup, incident-response, and evidence-management accounts.
• Design region restrictions, tagging controls, resource-sharing guardrails, baseline configurations, and account lifecycle security requirements.
• Assess existing landing zones and recommend improvements for governance, segregation of duties, resilience, compliance, and operational efficiency.

Identity, Access and Secrets Security

• Design workforce and workload identity architecture using AWS IAM Identity Center, IAM roles, permission sets, federation, temporary credentials, and least-privilege access.
• Define identity governance for privileged access, break-glass accounts, role assumption, service-linked roles, cross-account access, access reviews, and separation of duties.
• Use IAM Access Analyzer, credential reports, access-advisor data, and policy analysis to identify excessive or unintended access.
• Design secure secrets and key-management solutions using AWS Secrets Manager, AWS Systems Manager Parameter Store, AWS KMS, CloudHSM, and certificate services.
• Establish controls for root-user protection, MFA, access keys, credential rotation, resource policies, encryption keys, and machine identities.

Network, Edge and Infrastructure Security

• Design secure VPC architecture, subnet segmentation, route controls, security groups, network ACLs, VPC endpoints, DNS security, centralized egress, and hybrid connectivity.
• Architect inspection and protection using AWS Network Firewall, AWS WAF, AWS Shield, Route 53 Resolver DNS Firewall, Gateway Load Balancer, and approved third-party controls.
• Define secure connectivity patterns for Direct Connect, Site-to-Site VPN, Transit Gateway, PrivateLink, peering, multi-region, and hybrid-cloud environments.
• Review internet exposure, lateral-movement paths, ingress and egress controls, TLS configuration, certificate management, and network telemetry.
• Validate infrastructure hardening for EC2, load balancers, storage, databases, managed services, and administrative access paths.

Data, Workload and Application Security

• Design data-protection controls covering classification, encryption, tokenization, key ownership, backups, retention, replication, access logging, and secure deletion.
• Configure or guide use of Amazon Macie for sensitive-data discovery and AWS KMS for encryption governance.
• Define security patterns for EC2, Amazon EKS, Amazon ECS, AWS Lambda, container registries, serverless applications, databases, analytics services, and AI/ML workloads.
• Guide vulnerability management and workload protection using Amazon Inspector, Systems Manager, hardened images, patching standards, and secure configuration baselines.
• Embed security requirements into application architecture, API design, authentication, authorization, software supply chain, and third-party integrations.

Security Monitoring, Detection and Incident Response

• Design centralized logging and monitoring using AWS CloudTrail, AWS Config, Amazon CloudWatch, VPC Flow Logs, Route 53 logs, service logs, and secure log archives.
• Architect and operationalize Amazon GuardDuty, AWS Security Hub CSPM, Amazon Detective, IAM Access Analyzer, and relevant security services across accounts and regions.
• Integrate AWS security findings and telemetry with enterprise SIEM, SOAR, ITSM, threat-intelligence, and case-management platforms.
• Define detection use cases, alert-routing models, severity and prioritization standards, investigation procedures, containment patterns, and incident-response playbooks.
• Lead cloud-security incident investigations, root-cause analysis, recovery planning, lessons learned, and control improvement activities.
• Design automated remediation using Amazon EventBridge, AWS Lambda, AWS Step Functions, Systems Manager Automation, and approved orchestration tools.

DevSecOps, Infrastructure as Code and Automation

• Embed security controls into CI/CD pipelines and software-development workflows using policy as code, automated testing, artifact assurance, and security gates.
• Design and review Infrastructure as Code developed using AWS CloudFormation, AWS CDK, Terraform, or equivalent technologies.
• Implement secure pipeline patterns for source control, build services, artifact repositories, deployment roles, signing, provenance, secrets, and environment separation.
• Drive automation for account baselining, guardrail deployment, evidence collection, security validation, remediation, and reporting.
• Partner with development teams to manage SAST, DAST, SCA, IaC, secrets, container, and API-security findings based on application risk.

Risk, Compliance and Stakeholder Management

• Map AWS controls to applicable frameworks such as CIS AWS Foundations Benchmark, NIST CSF, NIST SP 800-53, ISO/IEC 27001, PCI DSS, SOC 2, and customer policies.
• Provide architecture evidence and technical support for audits, regulatory reviews, risk assessments, and customer assurance activities.
• Define security KPIs and KRIs, architecture-decision records, risk-treatment plans, exceptions, remediation roadmaps, and executive reporting.
• Facilitate security workshops and communicate architecture decisions, risks, trade-offs, and recommendations to technical and business stakeholders.
• Mentor security engineers and architects, develop standards and runbooks, and support security capability improvement across teams.

Preferred certifications:

• AWS Certified Security - Specialty.
• AWS Certified Solutions Architect - Professional.
• Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), or Certified Information Security Manager (CISM).
• AWS Certified Advanced Networking - Specialty, Kubernetes security, Terraform, or relevant DevSecOps certifications are desirable.